5 ms·

Personally I got tired of fighting my ISP for control of my router. Between CWMP and DOCSIS, I just gave up. So now I put my own NAT device/firewall behind the

Personally I got tired of fighting my ISP for control of my router. Between CWMP and DOCSIS, I just gave up. So now I put my own NAT device/firewall behind the router, and treat that outer 192.168.1.0 subnet, DHCP, DNS, etc as if they were public. My home network starts at _my_ router. In various periods of distrust for my ISP, I have also run the external interface of my NAT through a public VPN provider, and added monitoring to look for connection slowdowns or open ports on the router, as evidence of a compromise. So far it's just been jumping at shadows, though.

elktea 6y ago
Surprising amount of distrust of CWMP in this thread. As someone who implemented this and manages it at an ISP we really only use it to configure the WAN or VoIP connections.
- milankragujevic 6y ago
  Well yes but nothing prevents you from, for example, changing both user's passwords so they can't log in to even change WiFi password. [1] Needless to say, I don't trust it and disable it whenever I can. I can set up my PPPoE or VoIP access myself. [1] https://milankragujevic.com/uploads/oKazARE_.png https://milankragujevic.com/uploads/oKazARE_.png
  - elktea 6y ago
    Yes, agreed technical people are fine. Most users struggle with basic setup so it's a win for them. Personally, why would I do anything hostile that generates support calls?
    - milankragujevic 6y ago
      Agreed. For most people remote management is a life savior. But hostile can also be company policy, i.e. rewriting DNS servers every hour, etc.
neurostimulant 6y ago
I just bought a second router, put it behind the ISP-provided router, then mark the new router's ip address as DMZ. Works pretty well so far.
swiley 6y ago
When I had cable internet DOCSIS only configured this cheap "modem" box that I bought. It pretty much was just an adapter that turned the cable connection into an ethernet one. It sounds to me like people in this thread are buying routers with a built in modem and that creates a security problem because of how DOCSIS allows firmware uploads?
- IntelMiner 6y ago
  All DOCSIS devices by design only accept firmware uploads from the ISP they're connected to, you can't just log into the web UI on them and upload a firmware file Regular modems are the least annoying bet however. They simply hand over an IP address and then act as a transparent coax <--> Ethernet bridge minor edit: changed "vendor" to "ISP" to avoid confusion
Goz3rr 6y ago
The double router approach always seemed a bit weird to me. I'm really glad that in the Netherlands ISPs are required to make it possible for you to use your own networking equipment. I removed all the ISP equipment and replaced it with a Ubiquiti USG and a tiny bit of configuration.
- beached_whale 6y ago
  The added benefit is that it allows for a crude zoning. Untrusted devices go on ISP's router, trusted devices behind my own. This isn't perfect, but it does work.
kuroguro 6y ago
A bit off topic but my ISP is a big fan of MikroTik routers. IIRC MikroTik had 1 or 2 0-days a few years back that let you get root. Sure enough my ISP decided to leave their http and WinBox (config tool) ports open to everyone downstream - easy target. I contacted them and told them to upgrade the router and close the ports. Didn't get a reply but the ports were closed after a while so I thought that was that. Fast forward to a few weeks back - I was playing around with RoMON settings on my MikroTik router (it's their proprietary protocol for debugging/proxying/chaining routers behind nat so if you mess up the config you can still access it). Lo and behold - over 150 MikroTik routers, all one hop way from each other, all with RoMON on for all ports. All over the city judging form the AP names. All outdated as well. And to make matters worse - they hadn't even upgraded the one router upstream from me that I complained about in the first place!
chaorace 6y ago
I've been trying to set up something similar, do you have any advice for decent VPN providers? Each one I try caps out well below my bandwidth limit. For now, I've just been selectively routing specific non-TLS traffic over the VPN, but I know that's not necessarily a bulletproof practice.
- ohthehugemanate 6y ago
  I use PrivateInternetAccess (yes I know they were bought by a shady company, but I'm in the "wait for evidence of a problem" camp). Just did a test with fast.com, and I had 370Mbps with VPN, 410Mbps without. Perfectly OK for me. But as I alluded in my original post, since it seems like my ISP doesn't do any monkey business, I mostly leave it off. I have specific services running in my network that use it, but my vanilla traffic is unencrypted from my router. That said, even with no VPN I have a pihole backed by DNS-over-HTTPS, and almost all traffic (above 95%) goes over HTTPS or SSH anyway.
parliament32 6y ago
The majority of ISP-issued gateways/routers will happily run in "gateway"/"passthrough" mode, where pretty much everything is disabled and it passes your (globally routable) IP down through the first ethernet port.

elktea 6y ago

Surprising amount of distrust of CWMP in this thread. As someone who implemented this and manages it at an ISP we really only use it to configure the WAN or VoIP connections.

milankragujevic 6y ago
Well yes but nothing prevents you from, for example, changing both user's passwords so they can't log in to even change WiFi password. [1] Needless to say, I don't trust it and disable it whenever I can. I can set up my PPPoE or VoIP access myself. [1] https://milankragujevic.com/uploads/oKazARE_.png https://milankragujevic.com/uploads/oKazARE_.png
- elktea 6y ago
  Yes, agreed technical people are fine. Most users struggle with basic setup so it's a win for them. Personally, why would I do anything hostile that generates support calls?
  - milankragujevic 6y ago
    Agreed. For most people remote management is a life savior. But hostile can also be company policy, i.e. rewriting DNS servers every hour, etc.

neurostimulant 6y ago

I just bought a second router, put it behind the ISP-provided router, then mark the new router's ip address as DMZ. Works pretty well so far.

swiley 6y ago

When I had cable internet DOCSIS only configured this cheap "modem" box that I bought. It pretty much was just an adapter that turned the cable connection into an ethernet one. It sounds to me like people in this thread are buying routers with a built in modem and that creates a security problem because of how DOCSIS allows firmware uploads?

IntelMiner 6y ago
All DOCSIS devices by design only accept firmware uploads from the ISP they're connected to, you can't just log into the web UI on them and upload a firmware file Regular modems are the least annoying bet however. They simply hand over an IP address and then act as a transparent coax <--> Ethernet bridge minor edit: changed "vendor" to "ISP" to avoid confusion

Goz3rr 6y ago

The double router approach always seemed a bit weird to me. I'm really glad that in the Netherlands ISPs are required to make it possible for you to use your own networking equipment. I removed all the ISP equipment and replaced it with a Ubiquiti USG and a tiny bit of configuration.

beached_whale 6y ago
The added benefit is that it allows for a crude zoning. Untrusted devices go on ISP's router, trusted devices behind my own. This isn't perfect, but it does work.

kuroguro 6y ago

A bit off topic but my ISP is a big fan of MikroTik routers. IIRC MikroTik had 1 or 2 0-days a few years back that let you get root. Sure enough my ISP decided to leave their http and WinBox (config tool) ports open to everyone downstream - easy target. I contacted them and told them to upgrade the router and close the ports. Didn't get a reply but the ports were closed after a while so I thought that was that. Fast forward to a few weeks back - I was playing around with RoMON settings on my MikroTik router (it's their proprietary protocol for debugging/proxying/chaining routers behind nat so if you mess up the config you can still access it). Lo and behold - over 150 MikroTik routers, all one hop way from each other, all with RoMON on for all ports. All over the city judging form the AP names. All outdated as well. And to make matters worse - they hadn't even upgraded the one router upstream from me that I complained about in the first place!

chaorace 6y ago

I've been trying to set up something similar, do you have any advice for decent VPN providers? Each one I try caps out well below my bandwidth limit. For now, I've just been selectively routing specific non-TLS traffic over the VPN, but I know that's not necessarily a bulletproof practice.

ohthehugemanate 6y ago
I use PrivateInternetAccess (yes I know they were bought by a shady company, but I'm in the "wait for evidence of a problem" camp). Just did a test with fast.com, and I had 370Mbps with VPN, 410Mbps without. Perfectly OK for me. But as I alluded in my original post, since it seems like my ISP doesn't do any monkey business, I mostly leave it off. I have specific services running in my network that use it, but my vanilla traffic is unencrypted from my router. That said, even with no VPN I have a pihole backed by DNS-over-HTTPS, and almost all traffic (above 95%) goes over HTTPS or SSH anyway.

parliament32 6y ago

The majority of ISP-issued gateways/routers will happily run in "gateway"/"passthrough" mode, where pretty much everything is disabled and it passes your (globally routable) IP down through the first ethernet port.